Run-MPRC · daliu · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026 · Jul 22, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -89,16 +89,20 @@ jobs:
     name: Commerce command journal emulator
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'npm'
       - uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '21'
       - name: Install committed root dependencies
         run: npm ci --legacy-peer-deps --ignore-scripts
       - name: Install committed Functions dependencies
@@ -116,16 +120,20 @@ jobs:
   firestore-rules:
     name: Firestore security-rules tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: '20'
           cache: 'npm'
       - uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: '17'
-      - run: npm ci --legacy-peer-deps
+          java-version: '21'
+      - run: npm ci --legacy-peer-deps --ignore-scripts
       - name: Run Firestore rules tests against the emulator
         run: npm run test:rules
diff --git a/AGENTS.md b/AGENTS.md
@@ -99,7 +99,7 @@ npm run test:rules
 CI=true DISABLE_ESLINT_PLUGIN=true npx --no-install react-scripts build
 ```
 
-The Rules suite needs Java 17. The direct `react-scripts build` command is preferred for a diagnostic build because normal `npm run build` regenerates the sitemap. Run dependency audits for security/dependency issues, but do not apply forced automatic upgrades.
+The Rules and commerce-emulator suites need Java 21. The direct `react-scripts build` command is preferred for a diagnostic build because normal `npm run build` regenerates the sitemap. Run dependency audits for security/dependency issues, but do not apply forced automatic upgrades.
 
 The deterministic frontend Jest baseline is available through the command above. Hosted CI runs it as the blocking `Run frontend Jest tests` step under #124 and runs the standalone SPA suite under #126. #135 adds a tested manual, exact-commit, backend-first GitHub release gate and pauses Git-triggered Netlify production builds. This proves source shape only: protected environments/OIDC (#133), staged/live deployment (#136), fail-closed lint, required checks, Netlify publication, provider configuration, and production behavior remain separate work under #105 and WEB-001.
 

diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
diff --git a/GITHUB_ISSUE_SLICES.md b/GITHUB_ISSUE_SLICES.md
@@ -20,12 +20,13 @@ An agent-ready child has one observable outcome, one trust boundary, explicit de
 | CI-001B1 | merged/closed as #124; CI-001A | Run the complete committed frontend Jest suite as a named blocking step in the hosted frontend CI job; update exact officer/engineering truth. | Exact pull-request and post-merge hosted steps passed; Firebase skipped and Netlify exact production commit remained unverified. |
 | CI-001B1A | merged/closed as #126; #99 and CI-001B1 | Run the standalone same-origin SPA callback suite as a separate blocking hosted frontend step. | Local deliberate-failure proof plus the named hosted step passing on the exact pull-request and post-merge commits; no provider callback claim. |
 | CI-001B2 | published as #135; CI-001B1 | Provide the tested manual exact-commit source gate: fixed Rules/Functions, lockfile CLI, pinned Actions, short-lived-auth wiring, backend-first Pages dependency, missing-config failure, no frontend credential, and Netlify Git-production containment. | Source/static negative tests and exact PR evidence. #133 separately owns protected OIDC/environment configuration; #136 owns staged/target release; WEB-001 owns protected Netlify publication. |
-| CI-001B3 | source/tests tracked in live [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167); PAY-002B2A/#165 | Run the dedicated command-journal Firestore transaction suite as one named blocking Node 20/Java 17 job with exact demo project, explicit opt-in, Firestore-only scope, committed tooling, and no secrets/provider authority; require it at both protected-release CI reads. | Static negative workflow tests plus exact pull-request and post-merge hosted six-test evidence; no Firebase deployment, Stripe, website, or live claim. |
+| CI-001B3 | source/tests tracked in live [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167), with current Java 21 compatibility tracked in [#455](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/455); PAY-002B2A/#165 | Run the dedicated command-journal Firestore transaction suite as one named blocking Node 20/Java 21 job with exact demo project, explicit opt-in, Firestore-only scope, committed tooling, and no secrets/provider authority; require it at both protected-release CI reads. | Static negative workflow tests plus exact pull-request and post-merge hosted evidence; no Firebase deployment, Stripe, website, or live claim. |
 | CI-001B4 | merged/closed through [#186](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/186) / [PR #189](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/189) as `bec7d5e365eacb418563a172029f241f660d9768`; focused debt reductions tracked in [#227](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/227), [#239](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/239), functional removal in [#359](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/359), functional/file-count changes in [PR #391](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/391) and [PR #392](https://github.com/Run-MPRC/Run-MPRC.github.io/pull/392), and CI-001B4C [#449](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/449); CI-001B1 | Replace the mutating fail-open frontend lint line with a named blocking JS/JSX/TS/TSX exact-record gate. The original gate covered 102 files with 125 configured errors and 7 warnings. #227 removes one reviewed `arrow-body-style` error, #239 removes one stale `AdminMembers` suppression error, and #359 removes one prompt warning plus two label errors by deleting the unsafe reusable-link controls. Intervening reviewed source additions expanded coverage to 108 files by #359. PR #391 adds one TypeScript file and removes two TSX errors; PR #392 adds two TypeScript files and removes two more TSX errors. #449 replaces the four remaining stale `react-hooks/exhaustive-deps` directives with ordinary comments on the same lines. The gate now scans 111 files with 113 errors and 6 warnings. Disable the repository-wide severity-masking hook inside the lint process. Any added, removed, moved, or changed record and every fatal parser/configuration failure rejects with a fixed diagnostic; lint may not rewrite tracked files or create non-ignored untracked files. | Exact #186 PR run `29291402007` and post-merge run `29291515653` passed lifecycle-disabled install, direct lint, clean proof, tests, and build; each later focused issue records its separate source/hosted evidence. Ignored dependency/build paths remain outside this proof, with no clean-lint, branch-protection, deployment, website, Firebase, or provider claim. |
 | SUPPLY-001A | published as [#127](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/127); CI-001A | Prove `gpxparser` unused and remove its obsolete transitive chain. | `rg`/tree proof, before/after audits, root lockfile diff, full frontend checks. |
 | SUPPLY-001B | source/test delivery tracked in [#192](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/192); CI-001A | Pin React Router DOM/Router 6.30.4 and `@remix-run/router` 1.23.3; opt the declarative routers into `v7_startTransition` and `v7_relativeSplatPath` without a route redesign. | Exact three-node lock diff; Node 20 production audit 22→19 and high 8→5 with no router finding; focused route/future-flag tests, standalone callback suite, full CI, and build. |
 | SUPPLY-001C | source/tests tracked in live [#202](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/202); CI-001A | Pin the Firebase browser SDK to 11.10.0 and its Rules test helper to 4.0.1; bridge Node 20's native web APIs into the isolated Jest Rules environment without changing application behavior or provider settings. | Root production audit 19→6, critical 1→0, and high 5→3; focused Firebase/Auth/App Check tests, full frontend/Functions/Rules suites, standalone callback and safety suites, diagnostic build, dependency tree, and bundle comparison. Website publication, Firebase deployment, provider configuration, and live behavior remain unproven. |
 | SUPPLY-001D8 | source/tests tracked in [#453](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/453); CI-001A | Resolve the sole root SystemJS compiler transform from affected 7.25.9 to reviewed 7.29.7 through the unchanged `@babel/preset-env` 7.26.9 `^7.25.9` range, with no manifest or application change. | RED identity and upstream string-export regression; exact 16-entry lock closure; Node 20 production audit 4→3 and high 3→2 with GHSA-fv7c-fp4j-7gwp absent; all 49 non-map build files byte-identical and only the main source map's mapping/name tables changed. No website, Firebase, provider, or live claim. |
+| SUPPLY-001D9 | source/tests tracked in [#455](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/455); CI-001A, SUPPLY-001D8 | Pin the repository-owned Firebase CLI to 15.24.0, move both emulator gates to Java 21, and preserve lockfile-only tooling, exact demo projects, Firestore-only hosted scope, and credential-free local proof. | RED CLI/critical-range/runtime guards; Java 17 rejection; Java 21 Rules 378/378, commerce 63/63, and Auth/Firestore/Functions readiness; full root audit 64→58 and critical 2→0 while production stays 2 high/1 low; all 59 build files byte-identical. No website, Firebase, provider, or live claim. |
 | SUPPLY-001D | proposed; CI-001A | Upgrade Firebase Admin/Functions in one supported set. | Node 20 lint/unit/emulator/trigger tests and deploy compatibility notes. |
 | SUPPLY-001E | proposed; PAY-003C | Upgrade Stripe SDK and deliberately select/test an API version. | Signed fixture/test-mode diff and rollback notes; no live endpoint change. |
 | SUPPLY-001F | proposed; CI-001B2, A–C | Replace CRA while preserving env handling, SPA callbacks, sitemap/SEO, code splitting, and deploy output. | Full CI, bundle/SEO comparison, staging dry run. |

diff --git a/OPERATIONS_RUNBOOK.md b/OPERATIONS_RUNBOOK.md
@@ -172,8 +172,8 @@ Never print secret values into CI output, issue bodies, screenshots, chat, or th
 
 - Node.js 20 matching Functions runtime.
 - npm matching the lockfiles.
-- Java 17 for the Firestore emulator/rules tests.
-- Firebase CLI from the repository dependency where possible.
+- Java 21 for every repository-owned Firebase emulator command.
+- Firebase CLI 15.24.0 from the repository lockfile; never install or invoke a floating CLI.
 - Stripe CLI for signed local webhook testing.
 
 ### Install — available now
@@ -334,6 +334,10 @@ SUPPLY-001D8 [#453](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/453) i
 
 Clean before/after builds keep the same 49 non-map files, 9,975,968 bytes, and aggregate SHA-256 `3fa30c6d66827277432dcf7d42b0ead9e9fd543c9907571b092cfa43ba3f1e46`. Only the main source map changes. Its 477 source paths and contents are identical; updated mapping/name tables add 2,574 bytes. This does not change public runtime code. It does not publish the website, deploy Firebase, configure a provider, inspect production data, or prove live behavior.
 
+SUPPLY-001D9 [#455](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/455) pins the repository-owned Firebase CLI to 15.24.0 and moves both hosted emulator jobs to Java 21. The full root audit changes from 64 findings (2 critical, 32 high, 17 moderate, 13 low) to 58 (0 critical, 24 high, 21 moderate, 13 low): the old CLI `protobufjs` and `tar` critical groups are gone, but the remaining findings are not accepted as safe. The production-only root audit remains 2 high and 1 low. Java 17 must stop before emulator startup; Java 21 must pass the complete Rules and commerce suites plus the credential-free `demo-mprc-local` Auth/Firestore/Functions readiness smoke. Clean Node 20 builds before and after the upgrade are byte-for-byte identical across all 59 files and 19,520,717 bytes. The Functions manifest, lockfile, audits, and runtime source do not change.
+
+This is a maintainer and CI compatibility boundary. Officers do not install Java, run Firebase CLI, or deploy from a terminal. Source changes, local tests, hosted checks, merge, Firebase deployment, website publication, provider configuration, and production behavior remain separate evidence states.
+
 ### Race checkout request boundary — SOURCE ONLY, NOT LIVE
 
 PAY-001B1 [#219](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/219) makes the race checkout Function reject malformed or unexpected signup data in two steps. First, it checks one exact, bounded request shape before opening Firestore. Second, after the read-only commerce admission returns the event snapshot, it checks every submitted answer against the event's bounded participant or volunteer field definitions. A denial uses one fixed message and must occur before a rate-limit write, role or capacity call, token creation, registration write, Stripe Product creation, or Stripe Checkout Session call.
@@ -369,7 +373,7 @@ flowchart LR
 
 Text alternative: exact saved evidence, a matching closed transition, and a fresh later lease can create only an authorization record; a separate plan and send gate is still required.
 
-Run only with Node 20, Java 17, the repository lockfiles, and synthetic demo data:
+Run only with Node 20, Java 21, the repository lockfiles, and synthetic demo data:
 
 ```bash
 npm --prefix functions run test:run -- --runInBand commerceCommandJournal.test.js
@@ -403,7 +407,7 @@ Text alternative: the exact C3C authorization and current active lease can creat
 
 Version 1 allows no provider-parameter change. Account, mode, API version, operation, endpoint, and canonical parameters must equal attempt 1. Only the internally derived attempt-2 key commitment, current fence/time, attempt number, and authorization provenance may differ.
 
-Run only with Node 20, Java 17, repository lockfiles, and synthetic demo data:
+Run only with Node 20, Java 21, repository lockfiles, and synthetic demo data:
 
 ```bash
 npm --prefix functions run test:run -- --runInBand commerceCommandJournal.test.js
@@ -448,7 +452,7 @@ C4B leaves the existing version-1 plan-commitment bytes unchanged. It uses `prov
 
 The fixed permitted result contains only schema versions, `send_permitted`, and `pre_send_recorded`. The fixed ambiguous result contains only schema versions, `reconciliation_required`, and `provider_outcome_unknown`. Neither result proves caller authority, current business state, Stripe-account control, request execution, or a provider result. This boundary is only for `checkout_session_create` at `POST /v1/checkout/sessions`; Product/Price creation, Session expiry, refunds, and privileged provider actions need separate reviewed boundaries.
 
-Run only with Node 20, Java 17, repository lockfiles, and synthetic demo data:
+Run only with Node 20, Java 21, repository lockfiles, and synthetic demo data:
 
 ```bash
 npm --prefix functions run test:run -- --runInBand commerceCommandJournal.test.js

diff --git a/README.md b/README.md
@@ -79,7 +79,7 @@ npm run test:rules
 CI=true DISABLE_ESLINT_PLUGIN=true npx --no-install react-scripts build
 ```
 
-Rules tests require Java 17. The direct `react-scripts build` command is useful for a diagnostic compile because the normal `npm run build` runs the sitemap generator and may intentionally update `public/sitemap.xml`. Hosted CI runs the frontend Jest suite under [#124](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/124), the SPA callback suite under [#126](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/126), and the release-gate source tests under [#135](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/135). [#133](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/133) still owns protected environment/OIDC configuration; [#136](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/136) owns the actual staged profile-recovery release. Non-mutating lint, required branch checks, scanning, staging, and hosting consolidation remain open under [#105](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/105) and their atomic children.
+Rules and commerce-emulator tests require Java 21. The repository pins Firebase CLI 15.24.0; use only that lockfile copy with Node 20 and explicit `demo-*` projects. The direct `react-scripts build` command is useful for a diagnostic compile because the normal `npm run build` runs the sitemap generator and may intentionally update `public/sitemap.xml`. Hosted CI runs the frontend Jest suite under [#124](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/124), the SPA callback suite under [#126](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/126), and the release-gate source tests under [#135](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/135). [#133](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/133) still owns protected environment/OIDC configuration; [#136](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/136) owns the actual staged profile-recovery release. Required branch checks, scanning, staging, and hosting consolidation remain open under [#105](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/105) and their atomic children.
 
 These safety changes do not repair a missing member profile or prove deployed Firebase Rules/Functions. The reported profile-save failure remains [#118](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/118).